Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's "IPsec", not "IPSEC", FYI. (Some people really care about this, and will stop listening to you if you don't get this right.)

I don't agree with you. You'd have to review a lot of history to make that sort of assertion about the purpose of IPsec, and you'd have to ignore transport mode. Transport mode clearly exists to protect end-to-end... In transport mode the purpose of IPsec really is to protect all upper level protocol packet flows covered by local IPsec policy.

Also, since both, transport-mode IPsec and TLS are end-to-end, using both would be a serious waste of resources -- in practice few ever use transport mode, because any non-VPN, non-BITS/BITW uses of IPsec are just ETOOHARD to deploy and scale.

Of course, encrypting multiple times at different layers, but only once end-to-end, is not wasteful.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: